[schlessera]

Closes #2315
Closes #2382

What changed

The native SDK proof performs four sequential turns, but its parent allowed only one turn's time. The application proof similarly allowed 180 seconds for four individually bounded phases. Their parent deadlines now follow the selected work: four unchanged 20-second SDK turn plus five-second cancellation allowances, and the selected application phases at their unchanged 90-second limits plus existing cleanup. The containing native command accounts for those additional allowances. Both application selection and its budget use the same fixture inventory, and local receipts include the selected phases and budgets.

Why this shape

The original deadlines reproduce actual parent termination before a valid sequence finishes. The correction composes existing limits and preserves all identity, credentials, history, refresh, cancellation, refusal and owned-cleanup assertions. Both SDK full-profile callers share the limits; single-turn controls retain 25 seconds. The default, shared/private and explicitly selected application inventories are preserved.

Proof

Candidate 20028ce746ae7f0ac300a94d9731169498e1f79e, tree d5c8e524e7547762fb219673580dd4c87761700f, branches from main 82a64a13a08c44f2daef425d1a9df2c10840ea8e. The local preflight records the later comparison ref separately from its actual merge base. Complete hosted confirmation below tests the combination with 63fde3c8fe76e754aa4524f95b23f9786f4447fe.

• SDK mutation: restoring the original 25-second profile budget fails the actual native child-exit assertion with SIGTERM. Turns 0/1/2 finish at 7,510 / 15,197 / 23,022 ms and turn 3 initializes at 23,903 ms. Restored byte-for-byte before commit.
• Application failing-first: at effb25a15b8e3feb38596370726ca66e9a6a9338, controls/fresh/warm pass in 59.05 / 37.86 / 50.58 seconds; the original 180-second parent interrupts strict. This failed receipt remains unchanged.
• Phase inventory mutation: removing strict fails the named inventory assertion; restoration passes. Focused selector/variant tests pass 6 tests / 115 assertions; the earlier focused selector/collector/citation batch passes 49 tests / 151 assertions.
• Corrected complete native proof passes in 324.81 seconds on the pinned image, including all four application phases, both prepared-consumer modes and zero owned resources. The citation audit passes 44 tests / 113 assertions. Strict typecheck passes in 100.88 seconds with the repository's 4 GB Node setting. Mandatory preflight passes in 228.46 seconds: all lint/metadata gates, 956 fast tests / 6,328 assertions, and 11 affected tests / 158 assertions. No test failed or skipped. The command compared origin/main 63fde3c8fe76e754aa4524f95b23f9786f4447fe, with actual merge base 82a64a13a08c44f2daef425d1a9df2c10840ea8e; the affected subprocess records that merge base explicitly.

The first corrected attempt passes both SDK profiles, then correctly refuses a leftover unconfigured loop device from the preceding timeout. Its own cleanup passes. The prior receipt proves ownership of that exact device; after confirming no backing attachment or other container, an inode-bound cleanup removes only that unused device. The fixture refusal remains unchanged. The new qualification starts with the original prerequisite restored. This is separate from the original failed in-fixture cleanup.

Commands on the clean candidate:

bun scripts/prove-worker-identity.ts --image=sha256:7fbb483622c14a2feee72ca90dc7be86ffc64964a3d699f4f827a9503f57d7e5
NODE_OPTIONS=--max-old-space-size=4096 bun run typecheck
bun run check:pr --base origin/main

Hosted confirmation and merge-base assessment

Ready CI run 39079730529, attempt 1 passes all 16 selected jobs: changeset, verify, pack, unit (1–4), runtime, runtime_host, browser (1–2), layout (1–2), captures, endurance and proof. Every selected job's actual checkout log identifies 8f58e17b9918759c222a2761588000e3fe22c526; the aggregate receipt and immutable API/local git object agree on parents 63fde3c8fe76e754aa4524f95b23f9786f4447fe and 20028ce746ae7f0ac300a94d9731169498e1f79e, and tree 9bafce7fd33a5ee8b367f25f28136845cec40112. All selected categories execute successfully; the three unexpanded skipped matrix check names belong to the superseded draft run, not this ready proof. The current head's contract gate also passes.

Selected job IDs: changeset 117534062031; verify 117534277672; pack 117534277624; unit 117534277628 / 117534277629 / 117534277679 / 117534277712; runtime 117534277662; runtime_host 117534277596; browser 117534277639 / 117534277677; layout 117534277669 / 117534277700; captures 117534277612; endurance 117534277665; proof 117537563442. The earlier draft aggregate cancellation is superseded by this successful ready run; it was not retried as a test failure.

After hosted completion, main advances to b7a0885181445125d576e02f61c562d704c81099 via #2368. The complete intervening diff only strengthens diagram viewer/font assertions in two layout tests and updates their existing capture hash declarations. It does not change native SDK/application fixtures, deadline composition, product runtime, workflows, dependencies or test discovery. There is no overlap with this nine-file correction. Under the existing unrelated-base-advance rule, retain the successful hosted identities rather than restarting native proof. The predicted combination with that newer main has tree 1c76c2edc20ead25ffdec16dffa644459069e5b4; the older CI is not claimed to have tested it. The actual squash and automatic main-push results are recorded below.

Automatic main-push confirmation

2026-10-18: automatic main-push CI run 39081370533, attempt 1 passes all 16 selected jobs on squash 775eb17aab740fa759c2182f306c38fc17acbcbe. Every actual job checkout, including verify, pack and the aggregate job, matches that SHA. The immutable API and local git object agree on parent b7a0885181445125d576e02f61c562d704c81099 and tree 1c76c2edc20ead25ffdec16dffa644459069e5b4. The aggregate selects all nine proof categories, reports success for each, and retains no earlier execution. This establishes the actual combined main tree separately from the earlier PR run.

The test skips are verified against that checkout: 24 deliberately disabled paid image-provider cases; four inverse empty vector placeholders while their substantive controls pass; and ten soft-keyboard cases excluded only from the fine-pointer project, with all of those cases executing in the coarse and mixed projects. No selected job is missing, cancelled or skipped. The PR and both delivered issues retain milestone 0.44.0; #2315 and #2382 remain closed. The distinct Storage investigations remain open.

No changeset: only unshipped test fixtures, proof orchestration and moved documentation citations change. The package manifests ship src and dist.

Checklist

• Focused local preflight/behavioral receipts and complete selected hosted proof passed; actual head/base/job checkout evidence is in Proof.
• Acceptance criteria from the issues are all met, or the gap is named below.
• The PR and completed/advanced issues have verified release milestones under docs/process/github.md.
• A changeset is included, or this changes nothing a consumer can see.
• No personal data anywhere in the diff — the leakage gate covers the whole tree.
• The integration contract index or relevant component is updated in this same commit, or nothing in the machine surface moved.
• Docs under docs/ reflect the change, or nothing documented moved.
• Provider history stays append-only: nothing on a production turn's path changed.

Anything left open

No remaining acceptance gap for #2315 or #2382. The broader Storage feature and its distinct #2334 historical bundle investigation remain on #2172; this independent fixture correction does not resolve them. The matching-head squash and automatic main-push proof are verified above.

[schlessera]

2026-10-18: automatic main-push CI run 39081370533, attempt 1 passes all 16 selected jobs on squash 775eb17aab740fa759c2182f306c38fc17acbcbe. Every actual job checkout, including verify, pack and the aggregate job, matches that SHA. The immutable API and local git object agree on parent b7a0885181445125d576e02f61c562d704c81099 and tree 1c76c2edc20ead25ffdec16dffa644459069e5b4. The aggregate selects all nine proof categories, reports success for each, and retains no earlier execution. This establishes the actual combined main tree separately from the earlier PR run.

The test skips are verified against that checkout: 24 deliberately disabled paid image-provider cases; four inverse empty vector placeholders while their substantive controls pass; and ten soft-keyboard cases excluded only from the fine-pointer project, with all of those cases executing in the coarse and mixed projects. No selected job is missing, cancelled or skipped. The PR and both delivered issues retain milestone 0.44.0; #2315 and #2382 remain closed. The distinct Storage investigations remain open.